SecureDocker

automation for one; orchestration has to be seamless with provisioning tools

Since both Container and Host share a lot of Host Hardware , we need to consider a lot to just securing workloads #securedocker

is it a decision point to focus securing efforts on the base-image vs per container? #securedocker

Will a #ghost like vulnerability in containers makes our host machines Vulnerable? #SecureDocker

.@anshupande if there is access to the container, which is highly likely, than an application level vuln or vuln in the shared services of the host will make the container vulnerable to exploit #securedocker

Correct if your container gets hacked, you have to make sure that it is confined into the container.

@cloudpassage @anshupande I was able to exploit shellshock in an example app and get container access. I didn't try to access the host though was out-of-scope for my purposes #securedocker

You need the best tools to wrap the container with security, See my articles on containing containers.

.@rhatdan you should provide the links, they were good articles

http://opensource.co...

https://opensource.c...

Article 3 and 4 have been written and are going through the publishing process now.

Compliance is woefully behind container technology, if you run apps in containers in scope for PCI will you need to run AV in every container? I don't think auditors are ready to answer these questions

#Containers are definitely disrupting a lot of IT today and with the pace it is being embrased we will figure out all these challenges. There is no looking back #securedocker

We are working with out Certification people within Red Hat. But for now this is an unanswered question.

Docker needs to do better auditing and logging to the host.

But the Gov't want this. And we are looking to add these features.

@rhatdan As organizations push to use containers in cut-facing production environments, compliance will probably cause more angst then general security concerns

Some changes are needed within the kernel to allow us to determine where the audit messages are coming from. Which namespace.

Depends also on how you define a container. If you just say it is a privileged process running on the host, then Root==Root, it is less of a problem.

It is only when people start arguing for different security domains, that this is a problem.

BTW We have added MLS support to docker, so that MLS environments could run containers at different sensitivity levels.

@rhatdan Nice!

Where do you put your trust. Containers need a good signing strategy, which they don't have currently.

Also need to setup provenance. We are in some ways back to Linux 1999.

Making sure all important assets are secure while pushing to repo makes private repository an important consideration #SecureDocker

Where instead of people grabbing random RPM/Installs from the internet they are grabbing container images.

Think before you install an image, where did it come from? Can I trust it?

.@rhatdan you think people are just pulling the images, or pull and update? #securedocker

and confirm trust after install #securedocker

In the docker sense pulling an image, installs it.

right now there is no way to confirm trust

Hopefully docker will come to a standard or other container images can develop that can be signed by a known entity.

We are working to add signing, but it is a difficult problem.

Q1 - I think its already in mass production, lots of folks are already doing cool things with Docker #securedocker

Google deploys something like one million containers a day - so yes probably ready for primetime... :)

But in enterprise - not sure if traditional IT ops is ready to support containers in production #securedocker

@kurtmilne thanks for participating.

@kurtmilne What does traditional IT ops need that isn't there now? #securedocker

Lot of startups already using it. It is a game changer

I'd agree, Google/Baidu and pushing millions a day. Will startups embrace it which tend not to have "traditional IT" #securedocker

@kurtmilne Great point - are traditional IT Ops and security teams having to play catchup? What can they do

Many IT shops rely on virtal machine features like vmotion. #securedocker

There's a great infographic from @thecloudnetwork on the state of enterprise adoption http://bit.ly/1FIktg... #securedocker

if you put container in VM does it disrupt micro services type architecture? #securedocker

Many IT maybe not ready for "restart container" instead of "incident/problem" etc. #securedocker

@rtizzle catch up to what? Startup with no legacy systems to manage and maintain?

@rtizzle queue joke about startup IT not having the problem of a successful profitable business to deal with :)

Enterprises are starting to see the need for containers as a means of providing application portability... they're realizing how locked in they are to their #cloudcomputing providers without tools such as these #securedocker

@MacMJackson Agree.

trick will be for IT to not slow down developers as they figure things out behind the scenes #securedocker

@MacMJackson that portability means controls and other measures should be portable as well #securedocker

@rtizzle Definitely.